Businesses could face flood of ‘trivial’ compensation claims over GDPR worries

Businesses may be inundated with a large number of "trivial" data protection claims if the Supreme Court rules that emotional distress or anxiety resulting from data breaches can be compensated without proving actual harm, according to a hearing set to conclude on Thursday. The case, originally filed by 432 former and current Sussex Police officers against their pensions administrator, Paymaster, stems from a data protection breach in 2019 in which 450 individuals were sent annual pension statements containing sensitive information to outdated addresses.

The Supreme Court is being asked to determine if there is a minimum seriousness threshold for data privacy claims. While the Court of Appeal previously ruled there was no such threshold, Paymaster is challenging this decision. In 2024, High Court Judge Mr Justice Nicklin dismissed most claims, requiring claimants to prove the statement was read by a third party.

However, in 2025, the Court of Appeal overturned this, stating that sending data to the wrong address is sufficient ground for a claim without proof of third-party reading. If the Supreme Court upholds the Court of Appeal's decision, businesses could face an influx of frivolous claims, burdening them with additional time and expenses.

James Hyde, a commercial disputes partner at Addleshaw Goddard, stated that without court control over such trivial claims, the legal system and businesses will be swamped with individual and group cases based on spurious grounds.